SB2026082104 - Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
Published: August 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-44579)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper request handling in the Cache Components feature when processing crafted POST requests to a server action. A remote attacker can send a specially crafted request to cause a denial of service.
Only applications using Partial Prerendering through the Cache Components feature are vulnerable. The issue can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity.
2) Improper access control (CVE-ID: CVE-2026-44578)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in WebSocket upgrade handling in the built-in Node.js server when processing crafted WebSocket upgrade requests. A remote attacker can send a specially crafted WebSocket upgrade request to disclose sensitive information.
Only self-hosted applications using the built-in Node.js server are affected; Vercel-hosted deployments are not affected.
3) Resource exhaustion (CVE-ID: CVE-2026-41284)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in WebDAV LOCK and PROPFIND handling when processing request bodies. A remote attacker can send a large request body to cause a denial of service.
The affected requests are available to unauthenticated users.
4) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-45109)
CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to authentication bypass using an alternate path or channel in middleware.ts with Turbopack when handling segment-prefetch routes. A remote attacker can send a specially crafted request to disclose sensitive information.
The issue is an incomplete fix follow-up for the previously reported segment-prefetch route bypass in App Router applications.
5) Reversible One-Way Hash (CVE-ID: CVE-2026-44582)
CWE-ID: CWE-328 - Use of Weak Hash
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison shared cache entries and cause users to receive the wrong response variant for a given URL.
The vulnerability exists due to use of a weak hash in the React Server Component cache-busting mechanism when generating the _rsc cache-busting value for shared caches with insufficient response partitioning. A remote attacker can trigger collisions in crafted requests to poison shared cache entries and cause users to receive the wrong response variant for a given URL.
Only deployments that rely on shared caches with insufficient response partitioning are vulnerable.
6) Cross-site scripting (CVE-ID: CVE-2026-44581)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers.
The vulnerability exists due to cross-site scripting in App Router HTML rendering when processing malformed nonce values derived from request headers behind shared caches. A remote attacker can supply a malformed nonce value to poison cached responses and execute arbitrary script in victims' browsers.
User interaction is required, and exploitation affects App Router applications that rely on CSP nonces when deployed behind shared caches.
7) Cross-site scripting (CVE-ID: CVE-2026-44580)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a visitor's browser.
The vulnerability exists due to improper neutralization of input during web page generation in beforeInteractive script content serialization when embedding untrusted content into the document. A remote attacker can supply specially crafted input to execute arbitrary JavaScript in a visitor's browser.
User interaction is required to load the affected page.
8) OS Command Injection (CVE-ID: CVE-2026-44724)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to command injection in networkInterfaces() in lib/network.js when processing an active NetworkManager connection profile name obtained from nmcli output. A local user can create or rename an active NetworkManager connection profile with shell metacharacters to execute arbitrary commands.
The injected command runs with the privileges of the calling Node.js process.
9) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-44577)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the Image Optimization API when handling requests to the /_next/image endpoint for large local assets matching configured local patterns. A remote attacker can request large local assets to cause a denial of service.
Only self-hosted deployments using the default image loader are vulnerable. By default, all local patterns are allowed.
10) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-43514)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose the AJP secret.
The vulnerability exists due to observable timing discrepancy in AJP secret comparison when validating the AJP secret. A remote attacker can perform a timing attack to disclose the AJP secret.
Exploitation is limited to an attacker on the local network.
11) Interpretation Conflict (CVE-ID: CVE-2026-44576)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause cache poisoning that results in component payloads being served instead of the expected HTML.
The vulnerability exists due to interpretation conflict in React Server Component response handling when shared caches do not correctly partition response variants. A remote attacker can cause an RSC response to be served from the original URL to cause cache poisoning that results in component payloads being served instead of the expected HTML.
The issue affects applications using React Server Components with shared caches under affected conditions.
12) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-44575)
CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose protected content.
The vulnerability exists due to authentication bypass using an alternate path or channel in middleware matchers for App Router applications when handling segment-prefetch and .rsc route variants. A remote attacker can send specially crafted segment-prefetch or .rsc requests to disclose protected content.
The issue affects applications that rely on middleware or proxy-based authorization checks for protection.
13) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-44574)
CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authorization checks and access protected content.
The vulnerability exists due to authentication bypass using an alternate path or channel in middleware protection for dynamic routes when handling specially crafted query parameters. A remote user can send specially crafted query parameters to bypass authorization checks and access protected content.
The issue affects applications that rely on middleware path matching to protect dynamic routes.
14) Improper access control (CVE-ID: CVE-2026-44573)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in middleware authorization for Pages Router data routes when handling locale-less /_next/data//.json requests. A remote attacker can send a specially crafted request to disclose sensitive information.
Only applications using the Pages Router with i18n configured and relying on middleware or proxy-based authorization for protected page data are vulnerable.
15) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2026-44572)
CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to acceptance of extraneous untrusted data with trusted data in middleware / proxy redirect handling when processing a normal request with a spoofed x-nextjs-data header on a path that returns a redirect. A remote attacker can send a specially crafted request to cause a denial of service.
Exploitation requires the application to be deployed behind a caching CDN or reverse proxy that caches 3xx responses for the affected path without varying on the x-nextjs-data header.
16) Information disclosure (CVE-ID: CVE-2026-42498)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose authentication headers to a redirect target host.
The vulnerability exists due to exposure of sensitive information in Tomcat's WebSocket client when following a redirected WebSocket request after authentication. A remote user can trigger a redirect after authentication to disclose authentication headers to a redirect target host.
The issue occurs only if a WebSocket request is redirected after authentication.
Remediation
Install update from vendor's website.